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Ashish Khisti Member, IEEE, and Tie Liu Member, IEEE 

Abstract 

We study private broadcasting of two messages to two groups of receivers over independent parallel channels. 
One group consists of an arbitrary number of receivers interested in a common message, whereas the other group 
has only one receiver. Each message must be kept confidential from the receiver(s) in the other group. Each of the 
sub-channels is degraded, but the order of receivers on each channel can be different. While corner points of the 
capacity region were characterized in earlier works, we establish the capacity region and show the optimality of 
a superposition strategy. For the case of parallel Gaussian channels, we show that a Gaussian input distribution is 
optimal. We also discuss an extension of our setup to broadcasting over a block-fading channel and demonstrate 
significant performance gains using the proposed scheme over a baseline time-sharing scheme. 

I. Introduction 

There has been a considerable amount of interest in recent years in exploiting the properties of fading wireless 
channels for transmission of confidential messages (see e.g., [l]-[6] and references therein). Such studies have 
lead to new coding techniques such as the variable rate extension of the wiretap codebook [1], secure product 
codebooks [7] and secure multicast codebooks [4]. In the present work we study a setup where a single transmitter 
needs to serve two groups of receivers over a block-fading channel. There are K receivers in group 1, all 
interested in a common message, whereas there is a single receiver in group 2. The message of group 1 must 
be kept confidential from the group 2 receiver, whereas the message of group 2 must be kept confidential from 
group 1. We will refer to this setup as private broadcasting. In related work, references [8]— [10] study private 
broadcasting when there is one receiver in each group. References [11], [12] study private broadcasting with 
feedback over erasure and MIMO broadcast channels. Reference [13] studies interference alignment techniques 
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for private broadcasting. In this paper we focus on the case when there are M independent, parallel and degraded 
sub-channels and thereafter treat the natural extension to block-fading channels. 

Our setup reduces to previously known results at the corner points of the capacity region. When we only need 
to transmit the message for group 1, with the group 2 receiver as the only eavesdropper, the capacity can be 
achieved using a secure multicast codebook [4]. Instead, when we only need to transmit the message for group 
2, with all receivers in group 1 as eavesdroppers, the capacity can be achieved using a secure product codebook 
[7]. Interestingly the secure multicast and secure product codebook constructions are based on different ideas. A 
secure multicast codebook consists of M sub-codebooks, one for each channel. Each sub-codebook is a wiretap 
codebook [14], has the same rate as the transmitted message and guarantees confidentiality of the message from 
the eavesdropper on its respective link. The secure multicast construction guarantees that the legitimate receiver 
can decode the message by using the output of all the channels. Furthermore the message remains confidential 
from the eavesdropper even when all the channel outputs are combined. While the secure product codebook also 
uses one sub-codebook for each sub-channel, the rate of each sub-codebook equals the capacity of the legitimate 
receiver on that sub-channel. The secure product codebook takes a cartesian product of these codebooks and 
then applies the wiretap construction to this product codebook. This guarantees that the output codeword on 
any given sub-channel is (nearly) independent of the output codewords on other sub-channels. This limits the 
amount of information that gets leaked to an eavesdropper on any given sub-channel. Both the secure multicast 
codebook and secure product codebook result in a higher rate than a vector extension of the wiretap codebook 
to parallel channels. 

In this paper we study the case when both the messages need to be simultaneously transmitted. We find that 
a superposition construction achieves the entire capacity region. The proposed construction imposes a particular 
layering order for the secure multicast and secure product codebooks. The codewords in each sub-codebook of 
the secure product codebook must constitute the cloud centers, whereas the codewords in the associated sub- 
codebook of the secure multicast codebook must constitute satellite codewords. The optimality of such a layered 
coding scheme was somewhat unexpected. In absence of secrecy constraints, to the best of our knowledge the 
capacity region in the proposed setup remains open, even though the corner points are known [15]. We will 
provide an explanation on the sufficiency of the superposition approach after presenting the coding scheme in 
section III. 

For the case of independent Gaussian sub-channels, we further establish that a Gaussian input distribution is 
optimal. The proof involves obtaining a Lagrangian dual for every boundary point of the capacity region and 
then using an extremal inequality [16], [17] to show that the expression is maximized using Gaussian inputs. 
The result for the Gaussian channels are extended to a block-fading channel model using suitable quantization 
of the channel gains. We numerically evaluate the rate region for a sub-optimal power allocation and observe 
significant gains over a naive time-sharing approach. 
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II. Problem Statement and Main Results 

A. Independent Parallel Channels 

Our setup involves M independent parallel sub-channels and two groups of receivers. There are K receivers 
in group 1 and one receiver in group 2. The output symbols at receiver k in group 1 across the M sub-channels 
is denoted by 

y*; = (yfe,i,yfe,2, • • • ,yfe,M), k = i,2...,K, (l) 

whereas the output symbols of the group 2 receiver across the M sub-channels are denoted by 

z = (z 1 ,z 2 ,...,z M ), (2) 

and the channel input symbols are denoted by x = (x l7 . . . , x M ). 

Each sub-channel is a degraded broadcast channel. The degradation on sub-channel i can be expressed as 

x i -> ym(i),i ■ ■ ■ y-ir t (ii)s ->• z i ->■ yTr z (h+i),i ■ ■ -y^K)^ (3) 

for some permutation {^(1), . . . , ■n i (K)} of the set {1, . . . , K}. 

We intend to transmit message mi to receivers 1, . . . , K in group 1, while the message m 2 must be transmitted 
to the receiver in group 2. A length-n private broadcast code encodes a message pair (mi,m 2 ) 6 [1,2"^] x 
[1,2".R 2 ] mtQ a se q Uence x " sucn that Pr(mi ^ m^t) < e n , and Pr(m 2 ^ m 2) < £n, and furthermore the 
secrecy constraints 

-J(mi;z n ) <s n , -I(m 2 ;y%)<e n , k = l,2,...,K, (4) 
n n 

are also satisfied. Here {s n } approaches zero as n — > oo. The capacity region consists of the set of all rate pairs 
(i?i,i?2) achieved by some private broadcast code. The following Theorem characterizes this region. 
Theorem 1: Let auxiliary variables {t/j}i<,<M satisfy the Markov condition 

Ui -> Xj -> 3/^(1)^ • • -y^/i),, -> z» -> y 7 r 1 (/ 1 +i) : j • • -y W i(ji-),i- (5) 

The capacity region is given by the union of all rate pairs (i?i,i? 2 ) that satisfy the following constraints: 

Ri < min \ V /(x i; y M |ui, z 4 ) \ (6) 

— U=i ) 

R2 < ^in^ |^/(ui;Zi|y M )| (7) 

for some choice of {ui}i<i<M that satisfy (5). The alphabet of m satisfies the cardinality constraint \Ui\ < 
\X l \ + 2K-l. □ 
The coding theorem and converse for Theorem 1 are presented in section III and IV respectively. 
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B. Gaussian Channels 

Consider the discrete-time real Gaussian model where the channel output over sub-channel i at time index t 
is given by 

>*,<(*) = Xi(t) + n k ,i{t) (8) 
Zi {t) = Xi(t) + Wi (t), t = l,...,T. (9) 

The additive noise vectors x\k.i = (f)/t • • • , rik.i(T)) and = (wj(l),--- , iVj(T)) have entries that are 
sampled i.i.d. 7V(0, crj^) and Af(0,5f), respectively. Since the capacity region of the channel depends on the 
joint distribution of the additive noise (n\ t i(t), . . . , riK.i(t), Wi(t)) only through the marginals and that Gaussian 
variables are infinitely divisible, without loss of generality we may assume that for each sub-channel i the 
receivers are degraded as expressed in (3). We shall consider both the per sub-channel average power constraint 



^[l|x,|| 2 ] <Pi, V* = 1,...,M (10) 



T 

and the total average power constraint 

M 

i=i 

where = (x,(l), • • • , Xj(T)) is the input vector for sub-channel i. 

Theorem 2: The capacity region under the per sub-channel average power constraint (10) is given by the 
union of all rate pairs (i?i,i?2) that satisfy the following constraints: 

^^^\{g4:i(Q)} d2) 

^^^\{g4?(Q)} a3) 

for some power vector Q = (<Qi, . . . , Qm), where < Qi < Pi for alH = 1, . . . , M, 

+ 



2 log ^r^l-^logl 111 ^) (14) 



4?(Q) := 



1 

2"° \Q t + S, 




-i + 



^logl^^l-^oglT^^) (15) 



and x + := max{x,0}. □ 
A proof of Theorem 2 is provided in section V. 

Corollary 1: The capacity region under the total average power constraint (11) is given by the union of all 
rate pairs (Ri,R 2 ) that satisfy the constraints (12) and (13) for some power vectors P = (Pi, . . . , P M ) and 
Q = (Q u . . . ,Q M ), where < Q< < P< for all * = 1, . . . , M and J^Zi p i < p - D 

The above corollary follows directly from Theorem 2 and the well-known connection between the per sub- 
channel and the total average power constraints. We will not provide a proof of Corollary 1. 
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C. Fading Channels 

We consider a block-fading channel model with a coherence period of T complex symbols. The channel 
output in coherence block i is given by 

yfe(i) = h k (i)x(i) + n k (i) (16) 
z(i)=g(i)x(i)+ W (i), i = l,2...,M (17) 

where the channel gains hk(i) of the K receivers in group 1 and the channel gain g(i) of the group 2 receiver 
are sampled independently in each coherence block i and stay constant throughout the block. The coherence 
period T will be taken to be sufficiently large so that random coding arguments can be invoke in each coherence 
block. The channel input x(i) G C T satisfies a long-term average power constraint 

r 1 M i 
E mt£iI x «H 2 - p (18) 

t=l 

whereas the additive noise vectors i\k(i) and w(i) have entries that are sampled i.i.d. CAf(0, 1). We are interested 
in the ergodic communication scenario where the number of blocks M used for communication can be arbitrarily 
large. Furthermore we assume that the channel gains in each coherence block are revealed to all terminals 
including the transmitter at the beginning of each coherence block. 

Theorem 3: The private broadcasting capacity region for the fading channel model consists of all rate pairs 
(i?i,i?2) that satisfy the following constraints: 



Ri < min E 

Kk<K 



i? 2 < min E 

Kk<K 



log 



log 



1 + Q(h,g)\h k f 
l + Q(h,g)\g\ 2 

1 + P(h,g)\g\ 2 



log 



l+P(h,g)|/7 fc | 2 

l + Q(h,g)\h k f 



(19) 



(20) 



,1 + Q(h,g)|gf 

for some power allocation functions P(h,g) and Q(h,g) that satisfy < Q(h,g) < P(h,g) for all (h,g) G 
C K+1 , and E[P(h,g)] < P, where h := (hi, . . . , hx) denotes the channel gains of the receivers in group 1. □ 



A proof of Theorem 3 is provided in Section VI. 

Theorems 1, 2 and 3 constitute the main results in this paper. 

III. Coding Theorem 

The basic idea behind our coding scheme is illustrated in Fig. 1. The message m 2 is encoded using a product 
codebook [1], [7], whose codewords are obtained by taking cartesian product of the M codebooks, one for 
each of the parallel channels. The message mi is encoded using a multicast codebook [4], also consisting of 
M codebooks. As shown in Fig. 1, the codewords of the product-codebook constitute cloud centers of the 
superposition codebook, whereas the codewords of the multicast codebook constitute the satellite codewords. 
We describe the details of our construction in the following sub-sections. 
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Fig. 1: Superposition construction for the case of two channels. The product codebook for the group 2 user is 
obtained by taking a cartesian C21 X C22 of two independently generated codebooks and binning the resulting 
codeword pairs. The multicast codebook is generated, conditioned on the codewords of C21 and €22- 



A. Product-Codebook Construction 

The message iri2 is encoded using a product codebook [1], [7]. Let M.2,1 be the set of all binary sequences 
of length N 2 ,i = n(I(ui;z t ) - 2s) i.e., 

M 2 ,i := {0,1}^". (21) 

On channel i, we generate a codebook C2.1 '■ M. 2 ,i consisting of |A^2,*| codewords, i.e., 

C 2 ,, := K(m 2 ,i) : m %i £ [l, 2^-] } , (22) 

where each sequence uf is sampled i.i.d. from the distribution p Ui (-). Let 

M 2 := M 2 ,i x M 2> 2 x . . . x M 2 ,m (23) 
= {{m 2A ,...,m 2 , M ) : m 2 ^ G {0, 1}^, i = 1, . . . , A/} . (24) 

As shown in Fig. 1, we partition the set M 2 into 2 nR2 bins such that there are L 2 = 2 n {^= 1 1 (^;z t )-R 2 -Me} 
sequences in each bin. Each bin corresponds to one message m 2 E [l,2 nFt2 ]. Thus given a message /r>2 the 
encoder selects one sequence (/t?2.i, • ■ ■ , ^?2,Af) £ A^ 2 uniformly at random from the corresponding bin. On 
channel i we select the codeword uf E C 2> i associated with /T72,i- We note that from our construction, each 
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sequence in M 2 is equally likely i.e., 

M 1 

Pr(m 2 , 1 = m 2 ,i,...,m 2iM = fh 2 . M ) = []Pr(m 2iJ = m 2ij ) = — — : — (25) 

|A1 2 ,i| x |A1 2 , 2 | . . . , |A1 2 ,m| 

B. Multicast-Code Construction 

The codebook associated with mi is a secure multicast codebook [4]. For each u™ G C 2 .i, and each 
mi G [1, 2™- Rl ] we construct a codebook Ci^(u™ , toi) consisting of a total of L^, = 2™( / ( Xi;Zi l" i )+ £ ) codeword 
sequences of length n, each sampled i.i.d. from the distribution YYj=iPxi\ui( x ij\ u ij)- 

Let In be uniformly distributed over [1, Lii\. Given a message mj 6 [1, 2™ Kl ] and codewords (u™, . . . , u^), 
selected in the base layer, we select the sequence x™ from the codebook Ci^(u" , mi) corresponding to the 
randomly and uniformly generated index li^. The sequence x™ is transmitted on sub-channel i. 

The following property will be useful in our subsequent analysis. 

Lemma 1: The sequences (x^x^, . . . ,xj^) are conditionally independent given mi. 
Proof: Note that 

P(x{\- ■ ■ ,><M\mi) = ^2 p(x'i,...,x2 f ,m 2 A,...,m 2 M\mi) (26) 
= ^2 p ( x ™' • • • > x Ml m i> m 2,i, • • • ) m 2 ,M)p(m 2 ,i, ■ ■ ■ , m 2>M ) (27) 

{">2,,} 

= p ( x ™' ' • ' ' x Ml m i> m 2,i> • • • ) m 2M )p(m 2A ) . . .p(m 2 . M ) (28) 

{"12, i} 

= ^ p( x " I mi, m 2 ,i) ■ • .p(xjjf |mi, m 2;M M m 2,i) ■ ■■p{m 2 ,M) (29) 

{">2,i} 

M 

=nEp( x >^>Ki) (30) 

i=l m 2 ,i 
M 

M 

= np( x ^i m i) ^ 

i=l 

where (27) follows from the fact that the messages m 2i i, . . . , m 2i M are independent of mi; (28) follows from 
the fact that the messages satisfy (25); (29) follows from the fact that each x™ G Ci,»(/ni, uf) and u™ is a 
function of m 2j j. Eq. (32) establishes the conditional independence of the messages and completes the proof. 
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C. Decoding and Error Analysis 

1) Decoding of Message m\: Receiver k in group 1 selects those sub-channels Jk where it is stronger than 
the group 2 receiver: 

Jk = G [1, M] : x t -> y M -> z 4 } (33) 

• For each i e Jk, receiver fc selects a sequence tif <E C 2 ,i such that 1 (u^y^J G T™(ui, y kii ). We define 
£fc as the event that there exists some i G Jk such that {u" ^ uf}. 

• Receiver fc then searches for a message mi G [1,2"^] with the following property: for each i G Jk 
there exists a codeword x™ G Ci,i(mi, ) such that (x™,/^^ G T™(x i} yks\ui). An error is declared if 
mi ^ mi. 

Now observe that 

Pr( mi ± mi) < Pr(f fc ) + Pr(mi ^ m x |£ fc c ). (34) 

Since |C 2 ,»| < 2"( / ( u » Zi )- £ ) and /(t^jy^) > 7(u t ;z 4 ) for each i G J7fe, it follows that Pr(£ fe ) < Me. 
To bound the second term in (34) we use the union bound and analysis of typical events. 

Pr(mi ^ mi\E%) < 2 nRl J| { |C M 2-™( 7 ( x ^.*l Ui )- £ )} (35) 

< 2n-Ri2~™SieJ fe ( / ( Xi ;w.il Ui )- 7 ( Xi ; Zi l Ui ) _2£ ) (36) 

_ 2«-Ri2~"^iej fe ( / ( Xi ;J''=.il Ui ' Zi )~ 2e ) (37) 

which goes to zero provided that Ri < J2iej k I( x i: Yk,i\ u i, z %) — (2M+ l)e. Since e > is arbitrary, our choice 
of R\ in (6) thus guarantees that the error probability associated with message mi vanishes to zero. 

2) Decoding of message m 2 : The receiver in group 2 decodes message m 2 ,i on sub-channel i by searching 
for a sequence uf G C 2 ^ that is jointly typical with z™. Since the number of codewords in C 2 .i does not exceed 
2ri(/(u,:z,)-2e)^ tn j s event succeet j s with high probability. Hence the receiver correctly decodes (m 2j i, . . . , m 2iM ) 
and in turn message m 2 with high probability. 

D. Secrecy Analysis 

In order to establish the secrecy of message mi we need to show that 

-7(mi;z"|C) <e„ (38) 
n 

Using Lemma 1 and the fact that the channels are independent, we have that z" , . ■ • > z m are conditionally 
independent given mi . It follows that 

M 

-/(mi;z"|C)<]T/(mi;zr|C). (39) 

'We will use the notion of strong typicality. The set T"(x,y) denotes the e-strongly typical set. 
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Since in our conditional codebook construction, there are 2™^ / ^ Xi;Zi '" i ' +£ ' sequences in each codebookCi,i(u", mi), 
it follows from standard arguments that -7(mi;z™|C) < e n . The secrecy constraint (38) now follows. 
To establish secrecy of message m 2 with respect to user 1 in group 1, we show that 

^H(m 2 \y^ mi ) > R 2 - e n . (40) 

where for simplicity we drop the subscript associated with user 1 in the sequence y™. Without loss of generality, 
we assume that sub-channels i = 1, 2, . . . , L satisfy Xi — >• — > yi while sub-channels i = L + 1, . . . , M satisfy 
x i — >• y» —*Zi- Now consider 

H(m 2 M, m ) = H(m 2 \y?, . . . ,yft, mi) (41) 
= H(m^\yl\ . . . ,y£, mi) - ff(m 2 M i|m 2 , nn.yf, . . . ,y£) (42) 

M 

= £ ff( m2lj |yj\ mi) - #«i|"7 2 , mi.yr, • • • ,7m) (43) 

L 

> ^ (m 2J |yj\ mi ) - ^« 1 |m 2 , mi.yf, . . . , y n M ) (44) 

where (43) follows by establishing that the collection of pairs {(m 2j i,yf ), . . . , (m 2 ,M,yM)} is conditionally 
independent given mi, which can be establishes in a manner similar to the proof of Lemma 1 and (44) follows 
from the fact that the entropy function is non-negative and therefore we can drop the terms L + 1,...,M in 
the first summation. 

We lower bound the first term in (44). Recall that m 2 j is uniformly distributed over C 2 j with \C 2 j\ = 
2"( / ("i; z j)- £ ). Furthermore, the corresponding codeword u" is the base codeword in Cij(mi, o") and 

\Ci j(mi,u™)| = 2™( / ( X3;Zj ' Uj )~ e ) > 2 n ^ I< ^ Xi ' y ^ u ^~ e \ 

since the channel satisfies the relation Xj — > Zj — > y, for j = 1,...,L. Since the satellite codeword x" is 
uniformly selected from Cij it follows that [18, Remark 22.2, pp. 554-555] 

^H{m 2 ^,m x ) yi^-z^-I^-y^-e. (45) 

and therefore using the fact that Uj — > Zj — > yj , we have 

L L 

- ]T H{m 2J \yf, mi) > £ I(u 3 ;z 3 \ yj ) he. (46) 

We next upper bound the second term in (44). Note that 

H (mftlma, n^yf, . . . ,yft) < if (m 2 M i|m 2 , mi, y», . . . , y£, z£ +1 , . . . z&) (47) 
since z™ is a degraded version of y™ on channels j £ {L + 1, . . . , M}. Also note that 

f? = -#(m 2 ,i,...,m 2 , M ) (48) 
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M 

= -Vff(/77 2 ,,) (49) 



i=l 
M 



= ^{/(o,;z 4 )-2e}, (50) 
»=i 

where we use the fact that the messages (m 2i i, . . . , m2,M) are mutually independent (c.f. (25)). Furthermore 
we select 

R 2 = -H(m 2 ) (51) 

n 

L 

<Y,I(u i ;z i \y i )-{2M + l)s. (52) 

i=l 

Note that 

L M 

£- J R 2 >^/(u i ;y i ) + ]T J( u< ;zi) (53) 

i=l i=L+\ 

= /(ui,...,u M ;yi,...,y L ,z L+ i,...,z M ) (54) 

where the last step follows from the fact that we have selected Ui , . . . , Um to be mutually independent and the 
channels are also independent. We can therefore conclude that (c.f. [18, Lemma 22.1, Remark 22.2, pp. 554-555], 
[19, Lemma 1]) 

-H{m 21 \m 2 ,m- L ,y 1 , . . .,y L ,z L+1 , . ..z M ) 

< R- R 2 - . . . , u M ;yi,-- -,Yl,zl+i, ■ ■ -,z M ) +£ (55) 

L 

= J2 I (u i ;z i \y i )-R 2 + e. (56) 



-H(m 2 M, mi )>R 2 -(L + l)e, (57) 



Substituting (46) and (56) into (44) we have that 

1 

n 

Since e > can be arbitrarily small, this establishes the secrecy of message m 2 with respect to user 1 in group 
1. The secrecy with respect to every other user can be established in a similar fashion. 

Remark 1: The superposition approach uses the codewords for the group 2 user as cloud centers and the 
codewords of the group 1 user as satellite codewords. To justify this, note that on any given channel, say 
channel i, there is an ordering of receivers as in (3). Receivers {tt^U + 1), . . . , tt(K)} belonging to group 1 that 
are weaker than the group 2 user. It can be seen that these receivers do not learn any information on channel 
i. Thus among all the set of active users on any given channel, the group 2 user is the weakest user. Therefore 
the associated codeword of the group 2 user constitutes the cloud center. 



IV. Converse 

We first show that there exists a choice of auxiliary variables Ui(j) that satisfy the Markov chain condition 

"»(.?') -> **C?) -> y7r(i),<(i) • ■■y^(u)Aj) -> *»C?) -> y^+i),^.?') • ■ -y^^C?)- (58) 

such that the rates i?i and R 2 are upper bounded by 

M n 

nRl < ^I^ 7 ( x i(i);yM(i)l"i(i)^i(i)) + 2 ™£« (59) 
»=i i=i 

M n 

nR 2 <J2J2 T i"iU): *U)\yk,iU)) + 2ne n (60) 

i=l i=l 

for each fc G {1,. . . , if}. 

In particular we show that the choice of u»(j) is given by the following: 

Ui (j) = {m 2 ,Z^z^. +1 ,zr 1 } (61) 

where we introduce (c.f. (58)) 

z i ■= ( z i i y W (i i+ i),i) ■ • • > y ff (jf),i)! (62) 

Z~n /-n =n —n =n \ 

\i ■— \ z i > • • • > z i-ii z i+i! • • • > z m)> koj; 

z i _1 : = (^"'.yiii)^ • • - (64) 
z Ij+i : ~ ( z ^j+i)y™(i i +i),»,j+D • • • >y"(jf),»,j+i)) (65) 

and observe our choice of in (61) indeed satisfies (58). Note that z™ is the collection of the Group 2 

receiver's channel output as well as the output of all the receivers + 1), . . . ,ir(K)} in Group 1 that are 
degraded with respect to the group 2 receiver on channel i. 

We begin with the secrecy constraint associated with message m 2 with respect to user fc in group 1. Let us 
define the following: 



Yk,i' x k ^ z i ^ yk,i 

(66) 



y£:=(y fe V--,y fe », z " := WV--,^), (67) 
y2,i:=(y£i.- z " == (4\---, z f)- (68) 

Thus y£ corresponds to a weaker receiver, whose output on channel i is degraded to z™, if user fc is stronger 
than the group 2 user on this sub-channel. Clearly we have that -I(m 2 ; y£) < e„ whenever i/(m 2 ; y£) < e„. 
We thus have 

n(i? 2 - 2e„) < /(ma; z") - /(m 2 ; y£) (69) 
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</(™ 2 ;z"|y£) (70) 

M n 

= EE / ( m ^(. ? )kr\zr-i,y£) m 

i=i i=i 

M n 

^EE^'^^i' 2 "-!.^^ (72) 

M n 

^ EE^^v'^+i^r'^i^iyMO')) (73) 
i=i i=i 

M n 

= EE / (^(-?);^(-?)l3 ? M(.?)) (74) 

i=l i=l 

M n 

= ^^/( U ,( J );z,( J )|y M (j)) (75) 
where (73) follows from the fact that 

fe-y^CZv, (zf^^-^Czf 1 , (zTj+i./mj+iJCz?^, (76) 

and (75) follows from the fact whenever yk,i(j) ^ Yksij) trien z i{j) is a degraded version of yks{j) and 
from (66), we have that 

/(uiO');*0')|y)M(j)) = J"("i0');^C7)|yfc,*(j)) = °- (77) 

This establishes (60). 

Next, we upper bound Ri as follows: 

n(Ri - 2e n ) < /(mi; yJJ) - /(m i; z", m 2 ) (78) 
</(m i; y£|z",m 2 ) (79) 

M n 

^ E E n^;yk,iU)\yh\yk,i-i^ n , (»o) 
»=i j=i 

M n 

<EE ff te,i(j)|yjt;\y2,i-i,^^ (8i) 
»=i j=i 

M n 

= EE ff ^.^")i^^yM-i' zn '^)- ff o*,i(j)k(j),^(j)) (82) 
»=i j=i 

M n 

< EE ff fofc,iO')l* n . m 2) - ^(yM(i)k(i)^i(i)) (83) 
»=i j=i 

M n 

= EE^MWIZv^r'^^+i.ZiO-),^) - ff(y M (.?)k(.?)^(.?)) (84) 

»=i j=i 

M n 

= EE H ^,iO')l«iO').^0')) - //(y fe ,i(i)Wi)^(i) ; (85) 
i=i j=i 
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M n 

= EE 7 ^Wi^wi u< W' z< w)' (86) 
i=i j=i 

where (82) follows from the fact that for our channel model (y k ,i{j), are independent of all other random 

variables given Xi(j) whereas (84) follows from the fact that even though z" C {Z^, zf" 1 , z" J+1 , Zi(j)} holds, 
the additional elements in the latter are only a degraded version of z™. This establishes (59). 

To complete the converse, let qi to be a random variable uniformly distributed over the set {1,2,..., n} and 
furthermore we let Ui = (ui(qi), qi), Xi — Xi(qi) etc. Then (59) and (60) can be reduced to 

M M 

Ri - 2e„ < ^I(xi\y k ,i\ui,Zi, q,) = ^ /(x;; yfc^i/;, z;) (87) 

i=l i=l 
M M 

R2 - 2e„ < ^2l(ui;zi\y ki i,qi) < ^ I(m; Zi\y kii ). (88) 
i=i i=i 

The upper bound on the cardinality of Ui follows by a straightforward application of Caratheodory's theorem 
and the proof is omitted. 

A. Special case of K = 2 receivers 

For the case when there are K = 2 receivers, the upper bound can be obtained via an alternative approach 
which involves first obtaining single-letter bounds for a particular genie-aided channel and then combining these 
bounds in a suitable manner. 

In particular, suppose that we only need to transmit message mi to receiver 1 in group 1 and that the message 
m 2 only needs to be secure from user 2 in group 1. Under these relaxed constraints, it can be shown that any 
achievable rate pair (i?i,i? 2 ) must satisfy: 

M M 

Ri < ^I{xi\y hi \zi,Ui), R 2 < ^2l(u i ;z i \y 2 .i), (89) 

i=l i=l 

for some auxiliary variables {ui}i<i<M that satisfy the Markov chain in (58). Similarly if we instead consider 
transmitting message mi only to user 2 in group 1 and require secrecy of m 2 only with respect to user 1 in 
group 1, it can be shown that any achievable rate pair (Ri,R 2 ) must satisfy: 

M M 

Ri <^/(x i ;y2, i |z i ,v i ), R2<^I{v i -z i \y hi ). (90) 

i=l i=l 

for some auxiliary variables {\/i}i<i<M- Next, we show that on each sub-channel i we can always set Ui = Vi 
without affecting the upper bound. In particular we consider the following four cases: 

• Group 2 receiver satisfies Xj — >• z« — > (yi,i,y2,i)' It suffices to take Ui = Vi = Xi in (89) and (90) as the 
contribution of this sub-channel in the expressions for Ri is always zero. 

• Group 2 receiver satisfies Xi — > (yi.i,y2.i) — > It suffices to take Ui = = since the contribution of 
this sub-channel in the expressions for R 2 is zero. 
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• Group 2 receiver satisfies Xi — > yij — > z, — >• 3/2, Since the contribution of sub-channel i in the expressions 
of both R\ and i?2 in (90) is zero, we can set Vi = Ui without affecting the upper bound. 

• Group 2 receiver satisfies Xi — > y 2t i — >• Zj — > yi^: Since the contribution of sub-channel z in the expressions 
of both Ri and R2 in (89) is zero, we can set Ui = i/j without affecting the upper bound. 

Thus we need no more than one non-trivial auxiliary variable on each sub-channel. Setting v\ = m in (90) we 
have 

M M 

Ri < ^/(x 4 ;y 2:J |z 4 , Ui), R 2 < ^ I(u t ; z t \y hi ). (91) 

i=l i=l 

The converse follows by combining (89) and (91). 

Unfortunately when there are more than two receivers in group 1, we have not been able to obtain the converse 
directly from such single-letter expressions. Therefore our approach in the previous section was to identify a 
single auxiliary random variable m as in (61) that is simultaneously compatible with all the n-letter upper bound 
expressions. 

V. Gaussian Channels 

In this section we provide a proof for Theorem 2. Note that the achievability of the rate pairs (R\,R 2 ) 
constrained by (12) and (13) follows that of those constrained by (6) and (7) by setting = + v i7 where Ui 
and Vi are independent 7V(0, Pi - Qi) and W(0, Qi) respectively for some < Qi < Pi and i = I, . . . ,M. For 
the rest of the section, we shall focus on proving the converse result. 

Considering proof by contradiction, let us assume that (R°, R%) is an achievable rate pair that lies outside the 
rate region constrained by (12) and (13). Note that the maximum rate for message mi is given by the right-hand 
side of (12) by setting Qi = Pi for all i = 1, . . . , M [4], and the maximum rate for message m 2 is given by 
the right-hand side of (13) by setting Qi = for alH = 1, . . . , M [1], [7]. Thus, without loss of generality we 
may assume that R 2 = R 2 + 6 for some 5 > where R 2 is given by 

max R 2 

(Q,fl2) 

M 

subject to R°<Y^ A i!i(Q)' Vk = l,...,K (92) 

i=l 
M 

J?2<^4 2 i(Q) ; Vk = l,...,K (93) 

i=l 

Q 4 >0, V* = 1,...,M (94) 

Qi<P i: Vi = l,...,M. (95) 

For each fc = 1, . . . , K and i = 1, . . . , M let afc, M^j and M 2:i be the Lagrangians that correspond to the 
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constrains (92)-(95) respectively, and let 



K 



L := R 2 + ^ Qfc 
fe=i 



M 



fe=i 



A/ 



5>$(Q)-*2 



M 



M 



E m m^ + E M2 ^ p *-^)- 



(96) 



It is straightforward to verify that the above optimization program that determines i?2 is a convex program. 
Therefore, taking partial derivatives of L over Qi, i = 1 . . . , M and R 2 respectively gives the following set of 
Karush-Kuhn-Tucker (KKT) conditions, which must be satisfied by any optimal solution (Q*, R 2 ): 

E a k(Q* + vhr 1 + E fc(Qi + + m m = ( E + E & J + ^ 2 ) _1 + M ^ < 97 > 

if 

E^ = 1 ( 9g ) 

fc=i 

M 

^Ag(Q*)-i?? =0, Vk = l,...,K (99) 



i=l 
M 



E4 2 i(Q*)-^ 



= 0, Vfc= 



where 



M M Q* = 0, Vi = 1.....M 
M 2 ,i(Pi -Q*) = 0, Vi = l,...,M 
a fe ,/3fc >0, Vfc=l,...,X 
M M ,M 2ii >0, V* = 1,...,M 

3* := {fc : < <5?} and := {fc : > 5?}. 



(100) 

(101) 
(102) 
(103) 
(104) 

(105) 

(106) 
(107) 
(108) 
(109) 

i=l fc=l 

where (107) follows from the KKT condition (98), and (108) follows from the KKT conditions (99) and (100). 



Note that 5 > 0, so we have 



a k ) Rl + R° 2 > (j2 ak J R ° + R *2 

\k=l J \k=l ) 

K 

= J2(a k R° 1 +p k R* 2 ) 



k=l 
K 

E 

k=l 



M 



M 



ak 



E<](Q*)+ftE4?(Q*) 



M K 



= EEh A M(Q , )+A<!(Q*) 
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Next, we shall show that by assumption (RI.R^) is achievable, so we have 

(K \ M K 

^=1 / i=i /c=i 

which is an apparent contradiction to (109) and hence will help to complete the proof of the theorem. 
To prove (110), let us apply the converse part of Theorem 1 on (R°, R%) and write 



(110) 



K 



K 



M 



M 



J2 a k) R i + R 2 < I E afe ) 1 ^ K w2 I i x i'^yk,i\ u ^ z i) \ + K ™ K y^i{ u i\ z i\yk,i) > (in) 



\k=l 



\k=l 



K 

^E 

fe=i 



a/ 



a fcE J ( X » iyfc.il Uj,^) 



i=l 



if 

E 

fc=i 



M 



i=l 



(112) 



M K 



= ^2^2[akl{xi; yk,i\ui, Zi) + p k I(ui; Zi\y k!i )] , (113) 

i=l fc=l 

where (112) follows from the well-known fact that minimum is no more than any weighted mean. By the 
degradedness assumption (3), we have 



I(xi;yk,i\ui,Zi) = I{xi;y kti \ui) - I{x l :z l \u i ) 

= h(y k ,i\ui) - h(zi\ui) - h(n k ,i) + h{w t ) 

= h{y k! i\ui) - h(zi\ui) - ilog ^-jfj 

for any k e y t and 7(xj; yk,i\ui, Zj) = for any k y t . Similarly, 

I{ui\Zi\yk,i) = I(ui;zi) - {ui\y k ,i) 

= h(zi) - h(y k ,i) - h(z l \u i ) + h(y k ^\ui) 
1, ( Pi + Sf N 



< 2 log 



- h(zi\ui) + h(yk,i\ui) 



(114) 
(115) 

(116) 

(117) 
(118) 

(119) 



for any k G Z i7 where (119) follows from the worst additive noise Lemma [20], and I(uf, Zi\y k ^) = for any 
k £ Zi. Thus, for each i = 1, . . . , M we have 



K 



^2 [a k I(x i ;y k . i \u il z, i ) + P k I(ui\ Zj|y feii ) 



fc=i 



< E " fe 

key. 



h{y k A u i) - H z i\ u i) - 2 lo S 



.2 

k^ 

5? 



+ 



fcez, 



2 log 



- h(zi\ui) + h(y k<i \ui) 



(120) 



a kh{yk,i\ u i) + E PkHykA\ui) - E + E ^ fe h ( z i\ u i)- 

tex fce^i Vfcey, fce^ / 

"fc, / CT fc,A l Pk, ( Pi + $i\ 



(121) 
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We have the following lemma, which is the scalar version of the extremal inequality established in [17, 
Theorem 2]. 

Lemma 2: For any real scalars a k , (3k, Q*, Mi^ and M 2 .i that satisfy KKT conditions (97) and (101)— (104), 
we have 

^2akh(yk,t\u,) + ^ Pkh{y k A u -i) - I E ak + E /3k ) h ( z i\ u i) 
keyi keZi \key t kez t ) 

< E ? log(0 * + °& + Ey log ^ + <i) - Sfcey ' afc + Sfce ^^ MO? + ® d22) 

for any (uj,Xj) that is independent of the additive Gaussian noise ("i,,, . . . , riK.i, Wj) and such that E[xf] < Pi. 
□ 

We note here that the extremal inequality in [17, Theorem 2] was established using a vector generalization 
of Costa's entropy-power inequality. The scalar version that we used here, however, can be directly established 
using the original Costa's entropy-power inequality [16]. Substituting (122) into (121) gives 



K 



fe=i 



E [ukl{xi;yk,i\ u ii z i) + Pkl(ui;zi\y kii )] 

< E T log ^* + °2.*> + E T log ^* + - Ek ^ ak+ 9 Ek " zJk lo g (Q* + 51)- 



key, 



kez z 



^T l0g [-5f ) + ET l0g 



p. _|_ n 2 

- log —2 - - log ' 



(123) 



E afe 



k.i 



s? 



+ 



ZcG-Zi 



2 lo H^h2 log ioFT^ 



=Eh45(Q*)+^4?(Q*) 



(124) 



(125) 



Further substituting (125) into (113) completes the proof of (110). We have thus completed the proof of 
Theorem 2. 



VI. Fading Channels 

To establish the connection to fading channels, first observe that Theorem 2 and Corollary 1 can be extended 
in the following way. Consider the following scalar Gaussian broadcast channel with K + 1 users: 



y k (t) =x(t) + n k (t) 
z(t) = x(t)+ w(t), t = l,...,T. 



(126) 
(127) 
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At each time sample t, the additive noise (ni(t), . . . , nK(t), w(i)) are independent zero-mean Gaussian with the 
variances (a 2 , . . . , o\, S 2 ) selected at random as (a\ il . . . , a\ i , 8 2 ) with probability i = 1, . . . , M. Both 
the selection of the noise variances and the realization of the additive noise are assumed to be independent 
across the time index t and revealed to all the terminals. We are interested in the ergodic scenario where the 
duration T of communication can be arbitrarily large. The following extension of Thoerem 2 readily follows 
and its proof will be omitted. 

Corollary 2: For the scalar Gaussian broadcast channel considered above, the capacity region consists of all 
rate pairs (i?i,i? 2 ) that satisfy 

M 

Ri < min > Pi 

- - i=i 

M 

i? 2 < min > Pi 

~ Kk<K ^— ' 
_ _ i=l 

for some < Qi < Pi and i = 1, . . . , M. 

Clearly if the fading coefficients in (17) are all discrete-valued, then the result in Theorem 3 follows 
immediately from Corollary 2. When the fading coefficients are continuous valued, we can generalize Theorem 2 
by suitably quantizing the channel gains. 

First without loss of generality, we assume that each fading coefficient is real-valued, since each receiver can 
cancel out the phase of the fading gain through a suitable multiplication at the receiver. Consider a discrete set 

A:= {A 1 ,A 2 ,...,A N ,A N+1 } 

where Aj, < A i+1 , A\ := 0, An := J and An+i ■= oo holds. 

Given a set of channel gains (hi (i), . . . , h K (i), g(i)) in coherence block i, we discretize them to one of 
(N + l) K+1 states as described below. 

• Encoding message m\: Suppose that the channel gain of receiver k satisfies A q < hk(i) < A q+ i, then 
we assume that the channel gain equals s^fc = A q . If the channel gain of the group 2 user satisfies 
A q < g(i) < A q+1 then we assume that its channel gain equals Sj^+i = A q+i . 

• Encoding message m 2 : Suppose that the channel gain of the group 2 receiver satisfies A q < g(i) < A q+ i, 
then we assume that the channel gain equals s K+ i = A q . If the channel gain of a group 1 receiver satisfies 
A q < hk(i) < A q+ i then we assume it equals = A q+1 . 

Thus the channel gains in coherence block are mapped to one of L = (N + 1) K+1 states {sj}^ =1 . We denote 
the channel gains of the associated receivers in state Sj as (sj.i, . . . , Sj t K , Sj^K+i) and the channel gains of the 
associated eavesdroppers as (sj.i, . . . , Sj^K+i)- Note that in our notation, the K receivers in group 1 are labeled 
{1, . . . , K} while the group 2 receiver is labeled {K + 1}. 

With the above quantization procedure it suffices to consider a coding scheme associated for L = (N + 1) K+1 
parallel channels, where each parallel channel corresponds to one state realization Sj. Using Corollary 2 the 




(128) 
(129) 
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following rate pair (i?i,i?2) is achievable: 

L 

- - j=l 

^ < ^Pr( Sj )Ag( Sj ), (131) 



where 



^(■i)- r°si + Q( Sj )| S ^ +1 i 2 log i+Q(s,)is jlfe p • (133) 



For any J, taking the limit N — > oo we have that 



^Pr(s,)Ag(h, 3 )^ / /' Ai 1) (h, ff )dF( ff )^(h) (134) 
J=1 Jo Jo 

/■J />oo 

- i / 4 1) (h,. 9 )dF( 3 )^(h) (135) 
Jo Jo 



where 



A (1) fh a)- lo - 1 + Q(h,g)|fefcl 



and (135) follows from the fact that A^\-) = for Sk+i > J- Finally, by taking J arbitrarily large, the right 
hand side in (130) approaches 

/•oo /*oo 

i2i < min A / ^ 1) (h,ff)dF(5)<iF(h) (136) 

l<k<Kj J Q 

as required. In a similar fashion the achievability of i?2 can be established. 

The converse follows by noticing that if the channel gains are revealed non-causally to the terminals, the 
system reduces to a parallel channel model and the result in Theorem 2 immediately applies. 

A. Numerical Results 

In order to evaluate the achievable rate region, we assume that the fading gains are all sampled from 
CAf(0, 1). Furthermore instead of finding the optimal power allocation we assume a potentially sub-optimal 
power allocation: 



<2(h,<?)= I 



p, \g\ 2 >e 

(137) 

o, \ 9 \ 2 <e. 
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SNR = 20 dB 
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Fig. 2: Achievable rates (nats/symbol) for the two groups at different SNR values. The x-axis shows the rate 
Ri for group 1 whereas the y-axis shows the rate R2 for group 2. 



where 8 is a certain fixed parameter and assume that P(h, g) — P for all values of (h, g). Notice that 
our power allocation does not depend on the channel gains of the receivers in group l.This is a reasonable 
simplification when K is large and the channel gains {hi, . . . , hx) are identically distributed. The achievable 
rate expressions (19) and (20) reduce to: 



Ri < P<\g\ 2 < 0)E 



R2 < Pr(|g| 2 > 9)E 




(138) 



(139) 



In Fig. 2, we plot the achievable rates for P e {2, 10, 100}. We make the following observations: 

« The comer points for R\ and R 2 are obtained by setting 6 = 00 and 8 = respectively. By symmetry of 

the rate expressions in (138) and (139), it is clear that both the corner points evaluate to the same numerical 

constant. 

• As we approach the corner point (0, R2) the boundary of the capacity region is nearly flat. Any coherence 
block, where \g(i)\ < mini<fc</f is clearly not useful to the group 2 receiver. By transmitting m\ 
in these slots one can increase the rate R\ without decreasing R2. 

• As we approach the corner point (i?i,0), the boundary of the capacity region is nearly vertical. The 
argument is very similar to the previous case. In any period where \g(i)\ > maxKKK l^fcWI one cannot 
transmit to group 1. By transmitting m 2 in these slots we increase R 2 without decreasing 

• We observe that a natural alternative to the proposed scheme is time-sharing. The rate achieved by such 
a scheme corresponds to a straight line connecting the corner points. The rate-loss associated with such a 
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scheme is significant compared to the proposed scheme. 

VII. Conclusions 

We establish the optimality of a superposition construction for private broadcasting of two messages to two 
groups of receivers over independent parallel channels, when there are an arbitrary number of receivers in group 
1 but there is only one receiver in group 2. We observe that in the optimal construction the codewords of 
group 2 must constitute the "cloud centers" whereas the codewords of group 1 must constitute the "satellite 
codewords". For the case of Gaussian sub-channels the optimality of Gaussian codebooks is established. This 
is accomplished by obtaining a Lagrangian dual for each point on the boundary of the capacity region and 
then using an extremal inequality to show that the resulting expression is maximized using a Gaussian input 
distribution. An extension to block-fading channels is also discussed. Numerical results for Rayleigh-fading 
channels indicate that the proposed scheme can provide significant performance gains over naive time-sharing 
techniques. 
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